Cybercrime is not going away.

If anything, it’s becoming more and more prominent, to the point that even schoolkids are learning how to thwart bad actors alongside their ABCs.

Just hearing the numbers is scary: Nationwide notes that Cybersecurity Ventures estimates that the world spent upwards of $8 trillion on cyber threats in 2023 alone and that the cost of cybercriminal activity will reach $10.5 trillion by the end of 2025 — less than two years from now.

For the savvy risk manager looking to boost their cybersecurity efforts, having a cyber policy in hand can inspire a sigh of relief. But policies are beholden to the swings of the market, and with something as prevalent, volatile and relatively new as cyber, that can be challenging.

“One of the major ways to help combat the challenges of the market is by improving a company’s risk profile and equipping it with pre-breach strategies,” said Tim Nunziata, vice president and head of cyber risk, Nationwide.

“These are loss-mitigation strategies that can be offered through the primary carrier that are constantly evolving alongside the cyber landscape.”

Keeping up-to-date with those best strategies is key. Not only can they help protect against attacks, but they can also be a preventative measure that any risk manager is sure to want in their cyber risk tool kit.

It’s fundamental to work with a carrier that’s knowledgeable on these different loss-mitigation strategies and can connect a business to the right vendors to bolster its security efforts.

Below are five techniques that are proven to help stop cyberattacks in their tracks.

1) Multifactor Authentication

Tim Nunziata, vice president and head of cyber risk, Nationwide

Multifactor authentication, commonly referred to as MFA, requires all users within a system to provide a combination of two or more credentials that help confirm their identity before gaining access.

That could mean providing a password and also answering a security question, or it could mean logging in and then entering a code sent to their email or phone.

“Having that extra layer to log on can help prevent cybercriminals from getting into the system,” Nunziata explained.

Identity-based attacks — wherein cybercriminals steal someone’s personal login credentials and use that information to impersonate them across a business’s network — are on the rise. According to Crowdstrike’s 2023 Global Threat Report, 80% of cyberattacks leveraged identity-based techniques to compromise credentials during the previous year.

Having multiple steps to log in can thwart bad actors before they have a chance to get into the system.

2) Endpoint Detection and Response

EDR (endpoint detection and response) solutions are a great tool to prevent a breach.

Designed to provide continuous monitoring capabilities and enhance visibility across a network, EDR solutions include data search and investigation triage, contextualized threat hunting, and malicious activity detection, validation and containment.

These security tools actively analyze events stemming from laptops, desktop computers, mobile devices, servers, and even IoT and cloud services. If suspicious activity is detected, EDR solutions aim to shorten response time and get the cyber team activated before the damage is done.

“EDR provides the company with real-time monitoring of activity and reports on any unusual activity. These improved data analytics enable front-line risk evaluation and response to save time and money in resolving security issues.”

3) Patch Management

Any business using technology will have gone through some iteration of a software update. In the cyber world, these updates are called patches, and one of the best ways to prevent attack is through patch management.

“From the insured standpoint, the patching on their systems should be a constant effort. Even with all the understanding around known vulnerabilities, there are so many unknowns still out there, and as we get a better understanding of loss drivers, vulnerabilities and exposures, it’s important to implement patches and control what can be controlled,” Nunziata said.

Patches are implemented to fix bugs in the system, reduce digital vulnerabilities and improve performance.

It’s key to involve all the appropriate stakeholders in the process as well, including senior leadership, IT experts, insurers and their vendors, and even automated tools designed to keep networks up-to-date. And these patches should be constant.

“It’s those notifications on your device that say your computer is going to restart in four hours,” explained Nunziata. “This constant system management can be provided through the insurer as well, whether that’s inside-out or outside-in, to help identify vulnerabilities and patch them.”

4) End-of-Life Software Management

Another reality in the technology world is that old tech can become obsolete. When software reaches the end of its life, manufacturers will often discontinue technical support and upgrades for it.

End-of-life software management is paramount in protecting a company from the exploitation of vulnerable outdated technology at the hands of bad actors.

“The business should be asking itself on an annual basis about any services or software that may be winding down that might need action or upgrades,” said Nunziata.

As a loss-mitigation service, insureds will want to invest in a life cycle management plan that outlines protocols for phasing outdated or unsupported software out of their network. These plans should also help in introducing new technologies and planning for replacements when necessary.

This step will keep the entire network from having the weak spots that cybercriminals find ripe for infiltration.

5) Employee Education and Awareness

“Cyber protection review is about employee awareness as much as anything. The lion’s share of incidents is triggered by employee mistakes or oversight,” Nunziata shared.

“Understanding that these threats are out there and why one shouldn’t just click on links or reply without thought is important for cyber defenses.”

Employees are often called the first line of defense against cyberattacks — and for good reason: The World Economic Forum reports that 95% of cyberattacks stem from human error. Making employees aware of threats and how to detect them can go a long way.

“Training on what an inappropriate email looks like and teaching employees to take a step back and think are key,” said Nunziata. &

The post New Year, New Threats: 5 Cyber Mitigation Techniques to Review in 2024 appeared first on Risk & Insurance.

Meet with Apollo Dealer Services

Chat with us virtually or in person.